b989eac8db562acc63d6d9ba2aff517856289ac7dfa92aff23ac1beb474703c7

Analysis

max time kernel
143s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 08:38

Target

setup.exe
Size

937KB
MD5

49aa471fdbabf7faf343208ea34ac310
SHA1

ba9dee416550a5afdc27760a13fddc2881b474cb
SHA256

de2e881d63cdad2efb98dc7c392d55ae814516091290c2b7eeb3eb586dcbfb4c
SHA512

dd537f91e3c6da269dee27e37451c35bde2b9dd8e082df165f49e77983a744b04e59c91268612470d21413186331a793ab8cbc5c8bfee02a2d283266afc1b774
SSDEEP

12288:x3Mjhv0Dw888888888888W88888888888kDOlMR0q2Y0B/Awvyt0oPD4lwdmDml0:1Mjh8DzKBqo9mtpjkjHeSAcf8uTLFl

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1004	setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1004	3732	setup.exe	84
PID 3732 wrote to memory of 1004	3732	setup.exe	84
PID 3732 wrote to memory of 1004	3732	setup.exe	84

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\is-16UVK.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-16UVK.tmp\setup.tmp" /SL5="$90046,203776,0,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1004

C:\Users\Admin\AppData\Local\Temp\is-16UVK.tmp\setup.tmp

Filesize
1.5MB

MD5
a3d9d188d5031e5886c7bf3320a8c7e9

SHA1
034eaf37ae3c17d6b480cea2083d876922b416b1

SHA256
ae05972a53506e988052fcc0fe820512f8aeca54f670c91c07d1cfa7235e8080

SHA512
26303817bb77b4a9fbd9fec7ceb3e3413b698d8aab44391317e079e2429a2e23c1f2a0202dfa334a64eb4a81435868dcedf72a5a2ceb15336374de19f2649ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-16UVK.tmp\setup.tmp

Filesize
1.5MB

MD5
a3d9d188d5031e5886c7bf3320a8c7e9

SHA1
034eaf37ae3c17d6b480cea2083d876922b416b1

SHA256
ae05972a53506e988052fcc0fe820512f8aeca54f670c91c07d1cfa7235e8080

SHA512
26303817bb77b4a9fbd9fec7ceb3e3413b698d8aab44391317e079e2429a2e23c1f2a0202dfa334a64eb4a81435868dcedf72a5a2ceb15336374de19f2649ec4

Download Submit
memory/1004-143-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1004-147-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1004-148-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3732-133-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3732-146-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download